amadey | 13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
14/08/2024, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe
Size 1.8MB
Sample240814-e1s8aswgqg
SHA256 13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065
MD5 113bc038fe84de38995f20642177dc1e
SHA1 faffde07789a90122d2480a0396b994d65e31c4d
SHA512 4fb3622a05bb899f343c0eab645a1802c8f8f4213344540ae8a7982ad7ff4f68193f1c6968c4962412e6d00d619884ec0f3013ca5ae2ce857ce42d9184659660
SSDEEP 24576:quV4CKl9kAHhTZ8VK5201kNSuYSmNVcZzehy2to2vx/BN29CQsAC8QqkNXW4sJRg:quV4NoOhN8/NwJXcZsy+VOkHMkNgJR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 kora nord credential_access discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 7 IoCs

pid	Process
4224	explorti.exe
1592	ecde9732f4.exe
340	f08a015692.exe
3260	521782bbed.exe
1628	explorti.exe
4116	explorti.exe
3396	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Wine	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Microsoft\Windows\CurrentVersion\Run\ecde9732f4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\ecde9732f4.exe"	explorti.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3012-43-0x0000000000400000-0x000000000052D000-memory.dmp	autoit_exe
behavioral2/memory/3012-45-0x0000000000400000-0x000000000052D000-memory.dmp	autoit_exe
behavioral2/memory/3012-47-0x0000000000400000-0x000000000052D000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
3960	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe
4224	explorti.exe
1628	explorti.exe
4116	explorti.exe
3396	explorti.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1592 set thread context of 3012	1592	ecde9732f4.exe	84
PID 340 set thread context of 2204	340	f08a015692.exe	86

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecde9732f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f08a015692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	521782bbed.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3960	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe
3960	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe
4224	explorti.exe
4224	explorti.exe
1628	explorti.exe
1628	explorti.exe
4116	explorti.exe
4116	explorti.exe
3396	explorti.exe
3396	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	firefox.exe
Token: SeDebugPrivilege	2464	firefox.exe
Token: SeDebugPrivilege	2464	firefox.exe
Token: SeDebugPrivilege	2464	firefox.exe
Token: SeDebugPrivilege	2464	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3960	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe
3012	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2464	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 4224	3960	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe	78
PID 3960 wrote to memory of 4224	3960	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe	78
PID 3960 wrote to memory of 4224	3960	13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe	78
PID 4224 wrote to memory of 1592	4224	explorti.exe	79
PID 4224 wrote to memory of 1592	4224	explorti.exe	79
PID 4224 wrote to memory of 1592	4224	explorti.exe	79
PID 1592 wrote to memory of 1696	1592	ecde9732f4.exe	80
PID 1592 wrote to memory of 1696	1592	ecde9732f4.exe	80
PID 1592 wrote to memory of 1696	1592	ecde9732f4.exe	80
PID 1592 wrote to memory of 5032	1592	ecde9732f4.exe	81
PID 1592 wrote to memory of 5032	1592	ecde9732f4.exe	81
PID 1592 wrote to memory of 5032	1592	ecde9732f4.exe	81
PID 1592 wrote to memory of 4996	1592	ecde9732f4.exe	82
PID 1592 wrote to memory of 4996	1592	ecde9732f4.exe	82
PID 1592 wrote to memory of 4996	1592	ecde9732f4.exe	82
PID 1592 wrote to memory of 2896	1592	ecde9732f4.exe	83
PID 1592 wrote to memory of 2896	1592	ecde9732f4.exe	83
PID 1592 wrote to memory of 2896	1592	ecde9732f4.exe	83
PID 1592 wrote to memory of 3012	1592	ecde9732f4.exe	84
PID 1592 wrote to memory of 3012	1592	ecde9732f4.exe	84
PID 1592 wrote to memory of 3012	1592	ecde9732f4.exe	84
PID 1592 wrote to memory of 3012	1592	ecde9732f4.exe	84
PID 1592 wrote to memory of 3012	1592	ecde9732f4.exe	84
PID 1592 wrote to memory of 3012	1592	ecde9732f4.exe	84
PID 1592 wrote to memory of 3012	1592	ecde9732f4.exe	84
PID 1592 wrote to memory of 3012	1592	ecde9732f4.exe	84
PID 1592 wrote to memory of 3012	1592	ecde9732f4.exe	84
PID 1592 wrote to memory of 3012	1592	ecde9732f4.exe	84
PID 4224 wrote to memory of 340	4224	explorti.exe	85
PID 4224 wrote to memory of 340	4224	explorti.exe	85
PID 4224 wrote to memory of 340	4224	explorti.exe	85
PID 340 wrote to memory of 2204	340	f08a015692.exe	86
PID 340 wrote to memory of 2204	340	f08a015692.exe	86
PID 340 wrote to memory of 2204	340	f08a015692.exe	86
PID 340 wrote to memory of 2204	340	f08a015692.exe	86
PID 340 wrote to memory of 2204	340	f08a015692.exe	86
PID 340 wrote to memory of 2204	340	f08a015692.exe	86
PID 340 wrote to memory of 2204	340	f08a015692.exe	86
PID 340 wrote to memory of 2204	340	f08a015692.exe	86
PID 340 wrote to memory of 2204	340	f08a015692.exe	86
PID 4224 wrote to memory of 3260	4224	explorti.exe	87
PID 4224 wrote to memory of 3260	4224	explorti.exe	87
PID 4224 wrote to memory of 3260	4224	explorti.exe	87
PID 3012 wrote to memory of 1424	3012	RegAsm.exe	88
PID 3012 wrote to memory of 1424	3012	RegAsm.exe	88
PID 1424 wrote to memory of 2464	1424	firefox.exe	91
PID 1424 wrote to memory of 2464	1424	firefox.exe	91
PID 1424 wrote to memory of 2464	1424	firefox.exe	91
PID 1424 wrote to memory of 2464	1424	firefox.exe	91
PID 1424 wrote to memory of 2464	1424	firefox.exe	91
PID 1424 wrote to memory of 2464	1424	firefox.exe	91
PID 1424 wrote to memory of 2464	1424	firefox.exe	91
PID 1424 wrote to memory of 2464	1424	firefox.exe	91
PID 1424 wrote to memory of 2464	1424	firefox.exe	91
PID 1424 wrote to memory of 2464	1424	firefox.exe	91
PID 1424 wrote to memory of 2464	1424	firefox.exe	91
PID 2464 wrote to memory of 4404	2464	firefox.exe	92
PID 2464 wrote to memory of 4404	2464	firefox.exe	92
PID 2464 wrote to memory of 4404	2464	firefox.exe	92
PID 2464 wrote to memory of 4404	2464	firefox.exe	92
PID 2464 wrote to memory of 4404	2464	firefox.exe	92
PID 2464 wrote to memory of 4404	2464	firefox.exe	92
PID 2464 wrote to memory of 4404	2464	firefox.exe	92
PID 2464 wrote to memory of 4404	2464	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe
"C:\Users\Admin\AppData\Local\Temp\13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Users\Admin\AppData\Local\Temp\1000036001\ecde9732f4.exe
    "C:\Users\Admin\AppData\Local\Temp\1000036001\ecde9732f4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1696
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:5032
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4996
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2896
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3012
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1424
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {120ed890-c3b3-45cb-ba50-d2579aebe862} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" gpu
        7⤵
        
        PID:4404
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2074694b-ee70-4721-b039-482a5789a53a} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" socket
        7⤵
        
        PID:3160
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2824 -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 3048 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a2db6a2-4684-4d90-affa-ee4372c863f2} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" tab
        7⤵
        
        PID:3792
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3344 -childID 2 -isForBrowser -prefsHandle 3408 -prefMapHandle 3428 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {487c61af-c96c-4746-9f53-f9c318f17330} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" tab
        7⤵
        
        PID:756
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4424 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4436 -prefMapHandle 4432 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f074691-67c3-4870-a6e2-541c4c08afe0} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" utility
        7⤵
        Checks processor information in registry
        
        PID:2948
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -childID 3 -isForBrowser -prefsHandle 5540 -prefMapHandle 5480 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c26f9a22-6455-420a-9197-ec1613754497} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" tab
        7⤵
        
        PID:336
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 4 -isForBrowser -prefsHandle 5676 -prefMapHandle 5680 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd61c60e-ad31-433a-8418-9f2a1e9f2604} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" tab
        7⤵
        
        PID:1588
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5840 -childID 5 -isForBrowser -prefsHandle 5572 -prefMapHandle 5560 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2f8020d-c0f9-42fc-8954-018e68346f7b} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" tab
        7⤵
        
        PID:4484
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6264 -childID 6 -isForBrowser -prefsHandle 6208 -prefMapHandle 6272 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {759c27cb-0a91-4f66-a8c9-f3145b256887} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" tab
        7⤵
        
        PID:2964
- - C:\Users\Admin\1000037002\f08a015692.exe
    "C:\Users\Admin\1000037002\f08a015692.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:340
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2204
- - C:\Users\Admin\AppData\Local\Temp\1000038001\521782bbed.exe
    "C:\Users\Admin\AppData\Local\Temp\1000038001\521782bbed.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3260

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1628

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4116

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f08a015692.exe

Path C:\Users\Admin\1000037002\f08a015692.exe
Size 207KB
SHA256 4c947aa4de82538d4fd7e4f3bc3b6fca0fbd4dda8b5697deec2241a3765741ad
MD5 84f6ebedcc92bf18d5f52eef5055bd03
SHA1 ac5796ab6a6c5221b3e6a35a582ad57f8703b477
SHA512 22031302adfeebd2765d30e26556bc1817f89c8bcd452d2b6cbeae4ffe5c80b61f333822ea25bd297df45fdb57f82321a4f5441792e49b1b8b1f261d0ff1f311
SSDEEP 6144:+hSN6cD5W4D/QVbq+Lil56KFKWq0Cgj1vq+O:+dcETilhKWqNqvz
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x698r3gu.default-release\activity-stream.discovery_stream.json
Size 41KB
SHA256 136d7b71cf032eb3332ce56b9d3448b5c05116483ec5a85bf95f79c48e9cd58c
MD5 2002288021f3fa022861caff997ef89a
SHA1 ee56bb5d0d839706e76a0ead303a2eaab9418b54
SHA512 503dc79c7d3899815f3b6697a336166e7e5cb22f73a2a441a42c0b7c75cdc75c1995b0df58ab1fcdadd642ea833c0bd54e077beb56bd8fe83e736465dee09797
SSDEEP 768:ZJEstquLb8SI3zeOiY6WLew6nyd/BFSMBvWFRavZlWI7wGwUHxoN3tzr3wJ3kG:ZJpLoSoB6+3rxBFSGvWFRaRlWWw1UHCY
MD5 SHA1 SHA512 SSDEEP

Submit Download

E449899591A9BC91DFBA673EC0589B51E541A88B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x698r3gu.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Size 13KB
SHA256 50da7332cce386761e4f6beaccfc93d20f9bf22875248b2c8d0839c51cff7879
MD5 1ec9ba6b2424859ac85b7f3dee5607ae
SHA1 59b0fdd57b39c8a9ab7e1fce6a4abccbd1f3b464
SHA512 4ba31b48b0b7b8b421dd8271ddf9583114d6754d40f91a86724295683371a73a1f77fd51f22a13cda6df658b33ff528444f21593f1d3f83e76d74a6a576429f2
SSDEEP 384:H/Fu9fiGLm4pUFft2WlOX8lPLZZB7t0lpDII/BO:IBi8mCUFft2WAX8tzB7eD89
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065
MD5 113bc038fe84de38995f20642177dc1e
SHA1 faffde07789a90122d2480a0396b994d65e31c4d
SHA512 4fb3622a05bb899f343c0eab645a1802c8f8f4213344540ae8a7982ad7ff4f68193f1c6968c4962412e6d00d619884ec0f3013ca5ae2ce857ce42d9184659660
SSDEEP 24576:quV4CKl9kAHhTZ8VK5201kNSuYSmNVcZzehy2to2vx/BN29CQsAC8QqkNXW4sJRg:quV4NoOhN8/NwJXcZsy+VOkHMkNgJR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ecde9732f4.exe

Path C:\Users\Admin\AppData\Local\Temp\1000036001\ecde9732f4.exe
Size 1.2MB
SHA256 ea76ee73ec3bdc0ffdc801621f5c827c847dee2657700e7c5d73593587323323
MD5 a071730d9855b71c24be356e715bc481
SHA1 5889bb6a5f2884491dc6a47b5d5ab91d22296dea
SHA512 2a66103984a51f85eb5718169ed3fde288a45ae05ee3216b2da88f6fa3a4798256e6d9ed77f2482184f7390d7e41aa64f67e2c959f18e04e9a3f430658c830bd
SSDEEP 24576:CvL2FHA/T/A7ZESlRygXrA7sKd8PAAB+TJUlB12VStXBa7tH2:Cj2FAUTfb0sKdCMAv2VyXQZH
MD5 SHA1 SHA512 SSDEEP

Submit Download

521782bbed.exe

Path C:\Users\Admin\AppData\Local\Temp\1000038001\521782bbed.exe
Size 187KB
SHA256 37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
MD5 278ee1426274818874556aa18fd02e3a
SHA1 185a2761330024dec52134df2c8388c461451acb
SHA512 07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
SSDEEP 3072:/k9W0KFj5qj6o8KaxfE54HnnGqaKl+b2n8O43tIFmpKa:/kE/j5K62aOanGqCbAq3SFAKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\AlternateServices.bin
Size 7KB
SHA256 d9269c94667ce8340c29b398084f8be61d77bceaad2a4a1ce16984940039eb8d
MD5 1cef7d1d5751a04692bf5b4f21d86c0a
SHA1 8b32411582bd704c6d45da19e68c94e3c45a58ad
SHA512 0d630c90af33d2fb9a8501f3b3381bc59db1c8122ee0d2286b8b72bd83b310a81ec0bef49d389ae97213ebe70b4036d21f91a97abba8c28a423aafa9981f4646
SSDEEP 24:KuB1ozTDgu1xgRbWTvpR5cONTkuhMZWTAFsh2F3LFV/S9htKqEi:iD5ocv9cO5XaA7K0
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\AlternateServices.bin
Size 10KB
SHA256 ef80a49ac427737cc94a835e8a8fb60d4738292e90f80c224446cd43c00acef5
MD5 5ceec1c5f37a8621e3a736fb2cf2cb3b
SHA1 b1e99776a89b33e2a856c2267a92f4744946ec2f
SHA512 e25e618e644741f4fa541774da105bfc9e1d03365f27e83cece18abed2e7561cb7a7be61d66db63474d7ae358dfc72c5392a94d017f082126645a0169b35b854
SSDEEP 24:KuB1ozTsgu1xgRbjTrpR5cOj9TAuhMZY9TAFsh2F3LFV5S9htKko1ipp9B5o1i7v:is5orr9cOtn4A7KRkpLQkZ0k
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 88aa06f15b51e6ba2934f82e56a6cc41488d1ff073d0c7557612f7cde635d1c1
MD5 9e89889161f0777de460242cd6ae398a
SHA1 7f2ea196b90e547c9130854efaccd96819a4693c
SHA512 d2eee98ae06f7dd27a371938e1deffd79267c7b49b21b7b99c12a98dd0a78adc1b310bb35d15273ad3577998577562b09dd9aa2ebb32f3db300be8060af84ca5
SSDEEP 96:qB4SMF9ZbkW6QX0BB5hmkePP/PrWZ1PNRRBQKxtofFl66Joz0dzgClKtmSS:hrvZboH5hNwPC/bE/66Joz0dzgCl6mSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 637d5229172a53ed29f9378825f74ecdf8ae5e8c940c8c04377755eaec6d21ea
MD5 97e98fe9d99420cb2749931d113256cf
SHA1 f6fe185cbe585ee307f08a9b4ad4c76636bc12bb
SHA512 b1d820dcb88ee198f2842d90d080f71e10f999e7455ee5e7297a8cedd0b61bcd02587bd2d37397b9a90f420414c2673075363168efb5b044afe16954700c4252
SSDEEP 192:cbE/66Joz0dzgCl6mSSYrvZboH5hTwPDf3:cbE/66JozQzgC1bmboZSPr
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 25464adb901bd51d1fc86a62105bc0e95bf7fd060183550e3608d80479b969ed
MD5 642411ab8f4ba9e2f7492e62f7dd17e3
SHA1 d302291c5ecd78456a106b93c95907ba7e8534ed
SHA512 6050e730e1f82f5f7121b67ac4b783a3db96a3e1efc799992d299e39f5ed2d0f798d3de86c6f9edd42dc86d00065cf2a9d0f90a3318e1f82710a8c62ba0cc017
SSDEEP 384:EbiboZxEKPRObE/66JozQzgC1bHwGpfoL2X+Dxakkbqbbc:EbGnK5ObBm+ADuDxakkbqbbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 ce46bf772c797e9462c853da8f8d50159a6092deff94aeae869d27afd5c0465a
MD5 092a0b17ca9848360937b9af52720e2a
SHA1 5d037c97ce8a1ddcce43f1dc82bdb914bbe19c1e
SHA512 868b353200484528aea7603ffd5a82b074d4300a0d6db010b78cb09d8e4b22ba1f8ad5399e9955b886af8f69833d0d10db1a8b5a82f89292d5b29ac741e52b8f
SSDEEP 384:FwGpfoL2X+DxakkbqbbVbibozEKPRObE/66JozQzgC1bM:CADuDxakkbqbbVbGvK5ObBmm
MD5 SHA1 SHA512 SSDEEP

Submit Download

36fc3e8e-32ec-4219-82d3-1e8dec5722da

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\pending_pings\36fc3e8e-32ec-4219-82d3-1e8dec5722da
Size 26KB
SHA256 8b3628e3d866f96af372ad19540f0480f34cc1c750e283c7a97bb25742b9e491
MD5 b5c15bf969247cd4ae09196e0b42fecf
SHA1 d961f7c2d01920d9f4194d200aedfe383e805a47
SHA512 7cf7880e29e38c47c8660cd9b2150be345f8e6d7d92e89674a9c06ccc4cf71a1f100c8a044d7cd4ba13033f5f487cea64eb0c53bd420565e9d484a5db8be89a3
SSDEEP 192:O86uUQEmHDjFvqCsO2G7XSqRzJxE53Llyj8d5q0fdqcvfT2WPrHZRtSJsgcJgMgR:OuRjhvqcd7XSqRVxoBbBCIKi384+7
MD5 SHA1 SHA512 SSDEEP

Submit Download

9faec2b3-c184-46e2-9803-6cfd724a7859

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\pending_pings\9faec2b3-c184-46e2-9803-6cfd724a7859
Size 982B
SHA256 accfbce38203fc33803e9438a56e858816495b3c1d945fb9865fad481cab4fed
MD5 b7ce4f8a62211f4ddd1f6aae6ce62a5c
SHA1 6963893d3a42758faae50c7c57cffd44f044961d
SHA512 7d769859e85db8954e62e826331b389c2b0cf9f98e96d3004041bcda00c8282b78afdb38dffe8c25d6d5f5ce8333914d35d4bd46ed7817cc306af5e8d48765d4
MD5 SHA1 SHA512

Submit Download

debbfd7a-0300-40ab-a761-6fda52c9aa66

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\pending_pings\debbfd7a-0300-40ab-a761-6fda52c9aa66
Size 671B
SHA256 76d64d2ee16e83d8bfe00fed29ac6c7198a53c358c46523602b7ce87756caa8b
MD5 d2829631ae08d8959765cbc7d398509c
SHA1 57df353c16769786812c3e02f105fe01c5a52d03
SHA512 2fe774d3ae3aa31fd086e0fd6652bb2872c791f3fd59f7063bef3d8b42643c6dc203c3e3e3c7fdd31398249510cb60312f8700b1009fc1c726b710d2c01c14b3
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs-1.js
Size 11KB
SHA256 caffa5fa5f19dde0815f392ac825d9f46f48a464be19860bfde391d6975a3502
MD5 c3bd9d954d883dd0f9006946fb30dd5e
SHA1 9c9871c6026fc5ab2e3c5ce212e810effebee3d8
SHA512 c1f19b7b0a0f2c5887d152d549c5a002c6a4f3ae8f2a34573f9d50f8830ef4c02ffd3fd7b183157d242272e553c3193a2fe8301181ccd1e7a0d6389939a5e500
SSDEEP 192:gZ5nQRYfymwyDxzI4StWQLktJJWcdHtI44teQHrj60YaX/eOWOBw8HZ:gLRxz6bktn5tMeQLGue1swo
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs-1.js
Size 12KB
SHA256 bd70eb4a57f7ef06403de2982b7debe29eb9a6e093fc158913e8533e69dd2f42
MD5 75e4ef88167248f2453284164326e055
SHA1 5b912f3af925c2e7a425e9b87231919d72665c16
SHA512 ba95f512c2625bdb9178e81aca776bd02c2c05aa78338052aa684fc4a95c621bdc1685ee2a3e24e07a1fc5599f6aa6d8b55cbc7fdebb8cd548bb9d111c50e779
SSDEEP 192:+Z5nQRYfymwyDxzI4StWQLktJJWcdHtI44teQHrj60YaX/eOW/Bw8Hsr:+LRxz6bktn5tMeQLGue15w1r
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs-1.js
Size 16KB
SHA256 ed198b385ae68435119c04b967ec6cac26334968513ae84185e04acdd648b301
MD5 ea43aaf5ed148213c1198d5f13063dec
SHA1 1d61598584562623dded09e89d2b97afa25db935
SHA512 bfd4e4872d51e8e05ebb6a1b5000f383cddf9a880568e6d4fe59cf99143c98e2afd3b16cf0125d354b88ac33d37165ac7389bd209445473b3fedd6b0a05ed879
SSDEEP 192:+ZanQRYf/mwyDxzI4StWQLktJJWcdHtI44teQHrj60YaXB+eOWHiBw8HFJFEbu:+Oexz6bktn5tMeQLGze1QwMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs.js
Size 16KB
SHA256 b11ecf333d385bbdaf5280942d95e61eb8a77aae4dd4440beab9636c3d04d187
MD5 b0cdd1d58e946df4a36eef864beb1867
SHA1 6dce001c571d01d7e9f555fbbdd524a170246a09
SHA512 d778a7814a3a7dc854a19fc2fd30ab63b1c2e8bf1df5e3738396b2c69a946e4c141b4752b8d048a4ea1faca40fa50ef4f8c7e181ad48ee827d6d9ff6b8a90afb
SSDEEP 192:+ZanQRYfymwyDxzI4StWQLktJJWcdHtI44teQHrj60YaXB+eOWHiBw8HJ3v2bE:+ORxz6bktn5tMeQLGze1QwCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs.js
Size 10KB
SHA256 3b98e665bcbb6d6ba586455a81bdc7bcd706f8e89040fe2f7acbf83c3e99e4fb
MD5 492c78900c931a10cd90f04e78f9df4a
SHA1 38b5059d52125f0ed101d3606b187ca76276e6fc
SHA512 285a4da4bda0e20e73352c3353d0325ed65a4a5cad3ea531a64b3a7d434d9cdc03303a28f3423967029b4490019da067ebe2173ed9ca2ea9f0d185eb040b9f13
SSDEEP 192:gZ5nQRYfy3ue1Rf9tv2xCJ32cdx8TfOtb5xK04aXQeOWOBw8HZ:gL01R3vkQj0TUtGe1swo
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.6MB
SHA256 b2fdcb5245083fb0aaa39a7f5b1d18a619422b10cfb34e908656467023251d42
MD5 9fc2d176e9d9d959c1b5eec75aa8d36b
SHA1 5b5d163d92cbcb5454ed1f787e1963fa4b849f5f
SHA512 a538f1a4c5dc42fc62eee797644181325036a3176e52d91b310cb9bf5cbf83e556bb83392d0f01466905da07229489696ce43347132b6c34b00618969e27db97
SSDEEP 12288:UuBf685zeYNSCvRfJzEgg5u29SC/nFq3bm8:UmCmKVQBIlS0nFqLm8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/340-66-0x0000000000E40000-0x0000000000E7A000-memory.dmp

Download

memory/1592-40-0x0000000072D5E000-0x0000000072D5F000-memory.dmp

Download

memory/1592-41-0x00000000002A0000-0x00000000003D2000-memory.dmp

Download

memory/1628-360-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/1628-389-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/2204-70-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/2204-68-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3012-43-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3012-45-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3012-47-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3260-87-0x0000000000700000-0x0000000000943000-memory.dmp

Download

memory/3260-86-0x0000000000700000-0x0000000000943000-memory.dmp

Download

memory/3396-2606-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/3396-2599-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/3960-1-0x0000000077396000-0x0000000077398000-memory.dmp

Download

memory/3960-2-0x00000000003A1000-0x00000000003CF000-memory.dmp

Download

memory/3960-0-0x00000000003A0000-0x000000000084B000-memory.dmp

Download

memory/3960-3-0x00000000003A0000-0x000000000084B000-memory.dmp

Download

memory/3960-5-0x00000000003A0000-0x000000000084B000-memory.dmp

Download

memory/3960-17-0x00000000003A0000-0x000000000084B000-memory.dmp

Download

memory/4116-2590-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4116-2588-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-456-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-2591-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-21-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-472-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-19-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-455-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-1286-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-2513-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-2581-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-20-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-18-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-2593-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-454-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-2594-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-2595-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-2596-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-2597-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-451-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-434-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-2607-0x0000000000390000-0x000000000083B000-memory.dmp

Download

memory/4224-2608-0x0000000000390000-0x000000000083B000-memory.dmp

Download